Engineering notes, product updates, and security deep-dives from the immurok team.
Most people who want a wireless fingerprint key have two computers. Bluetooth pairing is 1-to-1, so making one key serve both cleanly took some design. Here's how dual-host works, and why we built it this way.
Read more →macOS has no single API you can plug a fingerprint into. immurok meets each authentication surface with the right mechanism — PAM, credential injection, or a GUI bridge — and keeps a hard security boundary around each. Here's the map, and an honest risk analysis.
Read more →A fingerprint key that accepts forged firmware is worthless, so the OTA pipeline is where immurok's security model either holds or collapses. This is how ours works: the .imfw package format, AES-CTR encryption, on-device verification, the migration from HMAC to ECDSA P-256 signatures, anti-rollback — and what it takes to run P-256 on a chip with 26KB of RAM and a 512-byte stack.
Read more →Notes from building immurok: a wrong MCU choice, a sensor swap, a tamper switch that only worked while powered, and a long fight to get standby current down to 50 uA.
Read more →Touch ID is excellent when it's built into the machine or keyboard. Everywhere else — Mac mini, Mac Studio, clamshell MacBooks, external keyboards, Linux desktops — desktop biometrics are still awkward. immurok is a small wireless fingerprint key for those setups, and on Linux it goes through PAM, not a stored password.
Read more →A fingerprint key is only as good as the trust it can prove. Here's how immurok keeps your biometrics on the device, authenticates every touch, and refuses to phone home — ECDH pairing, HMAC-signed events, and signed firmware, end to end.
Read more →Claude Code, Cursor, Codex, Aider — they all want to run sudo, push to git, or read API keys on your behalf. Here's how immurok turns one fingerprint touch into the human in the loop.
Read more →Millions of developers use desktop Macs and Linux machines without any biometric auth. We're building a tiny wireless fingerprint key to fix that.
Read more →